Every CVE Search/ Get API key

CVE-2026-59821

LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

2.1 LowFix available

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.90%Up 0.6 points since Jul 9, 2026
90%50%10%1%

What each source reports

CVE List Score used 2.1

LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable.

Record
CVE-2026-59821
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-94
Updated
2026-11-02
EUVDEUVD-2026-42350 2.1

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable.

Record
EUVD-2026-42350
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-72m8-9m7m-h278 2.1

LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

Impact

LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint.

A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In deployments without a configured master key, callers could be treated as proxy administrators, making this reachable without intended administrative authorization.

This could allow arbitrary code execution in the LiteLLM proxy container and exposure of secrets available to the process.

Patches

The issue is fixed in 1.82.0-stable.

LiteLLM recommend upgrading to 1.82.0-stable or later.

Workarounds

If upgrading is not immediately possible:

  1. Restrict access to POST /guardrails and PUT /guardrails/{guardrail_id} to trusted administrators only.
  2. Ensure LITELLM_MASTER_KEY is configured.
  3. Avoid enabling Custom Code Guardrails for untrusted users.
Record
GHSA-72m8-9m7m-h278
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-94
Updated
2026-11-02
NVD 2.1

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable.

Record
CVE-2026-59821
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-94
Updated
2026-11-02
OSV 2.1

LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.82.0-stable, LiteLLM's Custom Code Guardrails production create and update paths did not apply the same sandboxing and validation used by the test endpoint, allowing a privileged user with access to create or update guardrails to submit custom Python code that executed in the LiteLLM proxy environment and could expose secrets available to the process. This issue is fixed in version 1.82.0-stable.

Record
CVE-2026-59821
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-94
Updated
2026-11-02
OSVGHSA-72m8-9m7m-h278 2.1

LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

Impact

LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint.

A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In deployments without a configured master key, callers could be treated as proxy administrators, making this reachable without intended administrative authorization.

This could allow arbitrary code execution in the LiteLLM proxy container and exposure of secrets available to the process.

Patches

The issue is fixed in 1.82.0-stable.

LiteLLM recommend upgrading to 1.82.0-stable or later.

Workarounds

If upgrading is not immediately possible:

  1. Restrict access to POST /guardrails and PUT /guardrails/{guardrail_id} to trusted administrators only.
  2. Ensure LITELLM_MASTER_KEY is configured.
  3. Avoid enabling Custom Code Guardrails for untrusted users.
Record
GHSA-72m8-9m7m-h278
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-94
Updated
2026-11-02
OSVPYSEC-2026-3478 2.1

LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks

Impact

LiteLLM's Custom Code Guardrails production create/update paths did not apply the same sandboxing and validation used by the test endpoint.

A privileged user with access to create or update guardrails could submit custom Python code that executed in the LiteLLM proxy environment. In deployments without a configured master key, callers could be treated as proxy administrators, making this reachable without intended administrative authorization.

This could allow arbitrary code execution in the LiteLLM proxy container and exposure of secrets available to the process.

Patches

The issue is fixed in 1.82.0-stable.

LiteLLM recommend upgrading to 1.82.0-stable or later.

Workarounds

If upgrading is not immediately possible:

  1. Restrict access to POST /guardrails and PUT /guardrails/{guardrail_id} to trusted administrators only.
  2. Ensure LITELLM_MASTER_KEY is configured.
  3. Avoid enabling Custom Code Guardrails for untrusted users.
Record
PYSEC-2026-3478
CVSS 4.0
2.1 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
litellm
PyPI
 before 1.82.0
1.82.0
litellm
PyPI
 before 1.82.0, plus listed versions
0.1.00.1.10.1.20.1.2010.1.202
Show 45 moreShow less
0.1.2030.1.2040.1.2050.1.2060.1.2070.1.2080.1.2090.1.2100.1.2110.1.2120.1.2130.1.2140.1.2150.1.2160.1.2170.1.2180.1.2190.1.2200.1.2210.1.2220.1.2230.1.2240.1.2250.1.2260.1.2270.1.2280.1.2290.1.22910.1.2300.1.2310.1.2320.1.2330.1.2340.1.2350.1.2360.1.2370.1.2380.1.30.1.310.1.320.1.3300.1.3310.1.340.1.3410.1.343
1.82.0
litellm
PyPI
 before 1.82.0, plus listed versions
0.1.00.1.10.1.20.1.2010.1.202
Show 45 moreShow less
0.1.2030.1.2040.1.2050.1.2060.1.2070.1.2080.1.2090.1.2100.1.2110.1.2120.1.2130.1.2140.1.2150.1.2160.1.2170.1.2180.1.2190.1.2200.1.2210.1.2220.1.2230.1.2240.1.2250.1.2260.1.2270.1.2280.1.2290.1.22910.1.2300.1.2310.1.2320.1.2330.1.2340.1.2350.1.2360.1.2370.1.2380.1.30.1.310.1.320.1.3300.1.3310.1.340.1.3410.1.343
1.82.0

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-59821 is a low vulnerability (CVSS 2.1) in Berriai Litellm, published July 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.90%, the 60th percentile. Fixed in litellm 1.82.0.

References

This page doesn't list everything

Left out here: 1,714 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open